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Access  Control  Lists  (ACL) 


User  name  or  unique  identifier  associates  access  to  resources 
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User  associated  to  a  group  and  group  associated  to  resources 
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Essentials  for  resource  access 


Necessary  requirement  to  access  resources: 


•Not  a  user  name 
•Not  a  unique  identifier 
•Not  a  group  association 

•List  of  user  characteristics 
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What  are  user  eharaeteristies 


User  characteristics  (user  profile) 


•Where  elient  works:  organization 
•What  seeurity  eredentials:  clearance 
•What  pay  category:  pay  grade 
•What  branch  :  service 
•What  vocation:  job  function 
•etc 
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Examples  of  User  Profiles 

•User  profile  is  a  unique  list  of  user  eharacteristics. 

•A  elient  may  have  more  than  one  user  profile. 

•User  attributes  should  be  eompiled  from  an  authoritative 
data  source(s)  on  a  real-time  basis. 
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Impact  on  resource  access 


The  following  can  affect  resource  access: 

•Transfer  to  another  organization 
•Loss  of  security  clearance 
•Change  in  job  title 
•Job  promotion 
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Problems  with  ACLs  and  Groups 

Maintaining  an  updated  ACL  or  group  is  time 
consuming. 

Situation  worsens  when: 

•Number  of  users  increase 
•Number  of  resources  increase 


Resource  access 
management 
manhours 


Resources 
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NIST  RBAC  compliance 


Because  of  ACL  and  group  limitations: 


The  National  Institute  of  Standards  and 
Technology  (NIST)  RBAC  is  an  American 
National  Standard  -  ANSI  INCITS  359-2004 
(approved  19  Feb  04) 
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NIST  RBAC  standard 


Definitions: 

Users  and  Roles:  “...access  decisions  are  based  on 
the  roles  that  individual  users  have  as  part  of  an 
organization. 

"Access  rights  are  grouped  by  role  name.. . 


Role  hierarchies:  "Under  RBAC,  roles  can  have 
overlapping  responsibilities  and  privileges; 


Roles  and  Operations:  "Organizations  can  establish 
the  rules  for  the  association  of  operations  with  roles. 
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Access  control  comparison 


How  access  control  solutions  can 
simultaneously  evaluate  user  characteristics. 
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Customer  meta-database  background 

Relational  database  data  duplieated  on  a  direetory 
serviee. 
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Customer  meta-database  specifications 
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Customer  meta-database  domain 


Domain  consist  of  global  and  regional  directories. 
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User  Profile  Manager 


User  selects  a  profile  to  determine  resource  access. 
Mgmt  constraints  on  user  profile  selections 
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Step  1: 

Resource  manager  establishes 
a  set  of  conditions  to  access  a 
resource. 

These  set  of  conditions 
represent  a  resource  profile. 


Resource  Profile 

Trou=N65,  ou=N6,  ou=CPF,  ou=assignedCommand,  o=CPF 
^ou=secret,  ou=confidential,  ou=fouo,  ou=clearance,  o=Enterprise 
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How  the  ED  AC  works 


Customer  Meta-Database 
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Step  2: 

An  effective  RBAC  requires 
real-time  creation  of  user 
profile(s)  from  authoritative 
data  source(s). 
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How  the  ED  AC  works 


Step  3: 

The  RBAC  Rules  Engine  eompares  User  and 
Resouree  Profiles  to  determine  resouree  aeeess. 
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EDAC  -  Resource  profiles 
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ED  AC  -  Resource  profiles 
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•Pre-configure  conditions 
under  each  security  level. 
•RBAC  Rules  Engine 
evaluates  only  conditions  for 
prevailing  security  level. 
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EDAC  -  Model 


EDAC  standard  initiative: 


•Interchangeable  modular  access  control 
components 

•Minimum  salient  features 
•Protocol  between  components 
•Standard  tie-ins  between  customer  assets 
and  access  control  system 
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ED  AC  -  Model 


Customer  furnished  and 
maintained  assets 


Enterprise  Dynamic 
Access  Controi  (EDAC) 


EDAC  Process 

(A)  Administrative  Service  - 
establishes  resource 
containers,  CMD  referrals, 
RM  accounts. 
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ED  AC  -  Model 


EDAC  Process 

(B)  Condition  manager 
Service  -  Establishes 
and  edits  conditions  to 
access  resources. 
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ED  AC  -  Model 


EDAC  Process 

(C)  Condition 
deprecator  Service  - 
listens  for  CMD  content 
changes  and  flags 
unmatched  or 
unreachable  conditions. 
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ED  AC  -  Model 


EDAC  Process 

(E)  Customer  Object 
profile  manager  Service 
-  object  characteristic 
compilation,  selection 
and  formatting. 
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ED  AC  -  Model 


EDAC  Process 

(F)  Rules  Engine 
Service  -  evaluates 
object  and  conditions  to 
determine  object 
resource  access. 
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ED  AC  -  Interoperability 


EDAC  interoperable  among  regions: 

•Set  conditional  access  for  remote  users 
•Domain  customer  meta-databases 
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ED  AC  -  Interoperability 

Pearl  Harbor:  resource  profile 
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ED  AC  -  Interoperability 
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DoD 


Pearl  Harbor:  local  user 
profile  is  generated  to 
access  a  local  resource. 
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Pearl  Harbor:  user  and 
resouree  profiles  are 
evaluated  by  rules  engine  to 
determine  loeal  resouree 
aeeess. 


Pearl  Harbor 


DoD 
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ED  AC  -  Interoperability 


Pearl  Harbor:  A 
resource  profile  to  allow 
remote  users  access  to 
local  resources. 
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ED  AC  -  Interoperability 

San  Diego: 


user  profile 
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DoD 


San  Diego 


San  Diego:  same  user  evaluated 
for  San  Diego  resouree  aeeess. 
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